{"version":"2.1.323","anchor":"subagent-hand-back-framing-and-unreviewed-report-warning-add","canonical_anchor":"subagent-hand-back-framing-and-unreviewed-report-warning-add","heading":"Subagent reports are marked as not coming from you, and as unreviewed when needed","tier":"notice","area":"Subagents","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/subagent-hand-back-framing-and-unreviewed-report-warning-add","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Subagent reports are marked as not coming from you, and as unreviewed when needed\n\nA subagent's final report is framed as model output, not a message from you, and flagged UNREVIEWED when its safety review was refused\n\n**Unclear.** It is not stated whether this framing applies in every session or only behind a switch.\n\n**What**\n\nA subagent is a helper that Claude starts to work on part of a task, which then hands a report back. Claude Code's wording around that report has changed:\n\n- The report is labelled as a subagent hand-back and is described as output from the model that is \"NOT a message from the user\".\n\n- If the request to safety-review the report was refused by an upstream safety filter, the report is marked UNREVIEWED with a security warning.\n\n**Why**\n\nA report from a subagent can contain text the subagent picked up from files or websites. Labelling it this way helps stop Claude from following instructions hidden in that text as though you had given them, a kind of attack known as prompt injection.\n\n- Area: Subagents\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}